Tiered risk model for event correlation

Abstract

A method for real-time threat monitoring includes identifying two or more real time vulnerabilities, each associated with one or more objects of an enterprise, correlating the two or more real-time vulnerabilities to each other, applying a risk tiering model to the correlated real-time vulnerability, thereby classifying the correlated real-time vulnerability into risk tiers, and initiating an alert based on the correlated real-time vulnerability and the risk tiers into which the correlated real-time vulnerability is classified. According to other embodiments a method includes applying a risk methodology to log data contained in one or more object logs thereby identifying one or more security events, applying a risk tiering model to the one or more security events, thereby classifying the security events into risk tiers, and initiating an alert based on the security events and the risk tiers into which the security events are classified.

Description

FIELD[0001]In general, embodiments of the invention relate to identifying threats to an enterprise. More specifically, embodiments of the invention relate real-time threat monitoring, identification, classification and remediation.BACKGROUND[0002]Programmers and other cyber-criminals, referred to as “hackers,” are constantly creating new threats such as by circumventing traditional network firewalls and intrusion detection systems. Further, hackers appear to be attacking web applications directly through encrypted secure socket layer (SSL) sessions. Such attacks to websites and / or web applications, of course, can negatively affect business reputation, regulatory compliance, and continuity. The cost of web application security breaches can be very high and in some cases incalculable as breaches can reach across enterprises through every line of business, even affecting enterprise-customer relationships in some instances.[0003]In some enterprises, preventative vulnerability assessment...

AI Technical Summary

Benefits of technology

[0023]In some embodiments, the processing device is configured for analyzing comprising correlating two or more portions of log data based at least in part on the one or more outputs from the one or more controls applied to the log data, the correlating to identify one or more security events.

[0024]In some embodiments, the one or more object logs comprise one or more application logs corresponding to one or more applications of an enterprise. In some embodiments, the one or more object logs comprise one or more computing system logs of an enterprise. In some embodiments, the one or more object logs comprise one or more databases of an enterprise. In some embodiments, the processing device is further configured for initiating remediation of one or more of the security events based at least in part on the correlated log data and the one or more risk tiers into which the correlated log data is classified.

[0025]According to embodiments of the present invention, a computer program product includes a non-transient computer-readable memory comprising computer-readable instructions for real-time threat monitoring. The instructions includes instructions for applying a risk methodology to log data thereby identifying one or more security events, the log data contained in one or more object logs; instructions for applying a risk tiering model to the one or more security events, thereby classifying the one or more security events into one or more of a plurality of risk tiers; and instructions for initiating an alert based at least in part on the one or more security events and the one or more risk tiers into which the one or more security events is classified. In some embodiments, the instructions for applying a risk methodology to log data thereby identifying one or more security events include instructions for correlating two or more portions of the log data each corresponding to at least one of the security events.

[0026]In some e...

Problems solved by technology

Such attacks to websites and / or web applications, of course, can negatively affect business reputation, regulatory compliance, and continuity.

The cost of web application security breaches can be very high and in some cases incalculable as breaches can reach across enterprises through every line of business, even affecting enterprise-customer relationships in some instances.

However, other security breaches may be occurring on a much higher frequency and may not be detected absent more frequent monitoring.

Images